I'm using Let's Encrypt to secure an Apache installation on Ubuntu. I recently set up a deploy hook script to run on renewals, which I'm passing to
certbot renew in a cron job by using the
On the first renewal since setting it up, I noticed that the deploy hook script didn't run. Digging into the logs, I found that the invocation of
certbot renew that actually performed the renewal was not called with the
I also see that
certbot renew is being called three times per day, while my cron job is only set up to run once per day. One of those three calls is exactly at the time specified in the cron job, and the
--deploy-hook argument is provided. The other two times are around 00:30 and around 12:45, but the exact times vary by several minutes day to day. The
--deploy-hook argument is not provided on those other calls.
So: what on earth is running
certbot renew other than my cron job? I verified that only
root has a
crontab, and that it only contains the single job definition.